Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-23135

Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14.

Published

2021-05-12T23:15:07.757

Last Modified

2024-11-21T05:51:16.410

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

3.9

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-497
  • Type: Primary
    CWE-209
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application argoproj argo_cd < 1.7.14 Yes
Application argoproj argo_cd < 1.8.7 Yes
References